CVE-2022-44303: 
Ruby vulnerability analysis and mitigation

Resque Scheduler version 1.27.4 contains a Cross-site Scripting (XSS) vulnerability identified as CVE-2022-44303. The vulnerability was discovered on October 24, 2022, by TrungVM of VietSunshine Cyber Security Services. The affected component is the Resque Scheduler application, specifically version 1.27.4 (VietSunshine Report).

The vulnerability exists in the URL path /resque/delayed/jobs/{schedule_job}?args={args_id} where an attacker can inject malicious JavaScript code through the 'schedule_job' or 'args' parameters. The injection point allows for client-side JavaScript execution when the URL is accessed by a victim (VietSunshine Report).

When successfully exploited, the vulnerability allows attackers to execute arbitrary JavaScript code in the context of the victim's browser session. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (VietSunshine Report).

The vulnerability can be exploited by crafting a malicious URL containing JavaScript payloads in either the schedule_job parameter or args parameter. Example payloads include: 'https://{IP]/resque/delayed/jobs/%3Csvg%20onload=alert(document.domain)' and 'https://{IP/resque/delayed/jobs/EventEmailSalesTeamBefore48hrsJob?args=[%2249213%3Cimg+src=x+onerror=alert(document.domain)%3E%22]' (VietSunshine Report).